FreeBSD bsdinstall/bsdconfig os command injection

Summaryinfo

A vulnerability labeled as critical has been found in FreeBSD. Impacted is an unknown function of the component bsdinstall/bsdconfig. Such manipulation leads to os command injection. This vulnerability is listed as CVE-2026-45255. The attack must be carried out locally. There is no available exploit. A patch should be applied to remediate this issue.

Detailsinfo

A vulnerability was found in FreeBSD (the affected version unknown) and classified as critical. Affected by this issue is an unknown part of the component bsdinstall/bsdconfig. The manipulation with an unknown input leads to a os command injection vulnerability. Using CWE to declare the problem leads to CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

When bsdinstall or bsdconfig are prompted to scan for nearby Wi-Fi networks, they build up a list of network names and use bsddialog(1) to prompt the user to select a network. This is implemented using a shell script, and the code which handled network names was not careful to prevent expansion by the shell. As a result, a suitably crafted network name can be used to execute commands via a subshell. The problem can be exploited to execute code as root on the system running bsdinstall or bsdconfig. The attacker would need to create an access point with a specially crafted name and be within range of a Wi-Fi scan. Note that bsdinstall and bsdconfig are vulnerable as soon as the user prompts them to scan for nearby networks; they do not need to actually select the malicious network.

The weakness was presented by Austin Ralls. The advisory is available at security.freebsd.org. This vulnerability is handled as CVE-2026-45255 since 05/11/2026. The exploitation is known to be easy. Local access is required to approach this attack. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 05/24/2026). This vulnerability is assigned to T1202 by the MITRE ATT&CK project.

Applying a patch is able to eliminate this problem.

The vulnerability is also documented in the databases at EUVD (EUVD-2026-31263) and CERT Bund (WID-SEC-2026-1628). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• FreeBSD Project FreeBSD OS

Productinfo

Type

• Operating System

Name

• FreeBSD

License

• open-source

Website

• Product: https://www.freebsd.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion